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Amendments to the Claims 

This listing of claims will replace all prior 
versions, and listings, of claims in the application:* 
Listing of Claims: 

1-10. (Cancelled) 

11. (New) A cryptographic method employed between 
two entities exchanging information via a non-secure 
communication channel, each of the two entities comprising a 
memory readable by a machine, tangibly embodying a program of 
instruction executable by the machine to perform the method, 
the method including a step of multiplying an odd order point 
of a non-supersingular elliptic curve by an integer, wherein, 
for exchanging information via the non- secure communication 
channel, the step of addition and halving of points of said 
elliptic curve, the halving of a point P is defined as a 



unique odd order point D such that [2]D = P, 



denotes the 



halving operation and 



P denotes the point D. 



12. (New) A method according to claim 11, where F 2n 
is a finite body of 2 n elements, E ( F 2 „ ) is the sub-group of an 
elliptic curve E defined by: 

E(F 2 n ) = { (x,y)€ F 2 n X F 2 n (y 2 + xy = x 3 + ox 2 + p} ^ {0} a, p e F 2 n , p * 0 
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and E[2 k ] is the set of points P of said elliptic curve such 
that P added 2 k times to itself gives the neutral element O, 
where k is an integer greater than or equal to 1, wherein a 
point P = (x,y) of said elliptic curve gives by said halving 



the point 



P = (u 0 ,v 0 ) of said elliptic curve obtained by 



effecting the following operations: 

(a) seek a first value A, G such that X Q 2 + X Q = a + x; 

(b) calculate a second value u Q 2 such that u Q 2 = x (X 0 + 1) + y; 

(c) if k has the value 1, check if the equation: X 2 + X = a 2 + 
u 2 0 has solutions in F 2 n ; 

(d) if the check in step (c) is yes, calculate said halving as 
follows : 



and 



u 0 = V u o 2 / 

v 0 = u 0 (u 0 + X Q ) , 

P = (u 0 , v 0 ) ; 



(e) if not, add x to said second value u D 2 and 1 to said first 
value X Q and calculate said halving as in step (d) ; 

(f) if k is greater than 1, perform an iterative calculation 
as follows: 

(i) seek a value X± such that A, j. 2 + X± = a + u±.i ; and 
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(ii) then calculate the value u 2 ± such that u 2 i = ui_i (Xi + 
^i-i + Ui_i +1) by incrementing i from i = l until the value u 2 k -i 
is obtained; 

(g) check whether the equation X 2 + X = a 2 + u 2 k-i has solutions 
in F 2 n ; 

(h) if so, calculate said halving as follows: 



and 



Uo = V u o 2 / 

v 0 = u 0 (u 0 + X 0 ) , 

— P = (u 0 , v 0 ) ; and 
2 



(i) if not, add x to the second value u G 2 and 1 to said first 
value X 0 and calculate said halving as in step (h) . 

13. (New) A method according to claim 11, where F 2 n 
is a finite body of 2 n elements, E(F 2 n ) is the sub-group of an 
elliptic curve E defined by: 

E(F 2 n ) = { <x,y) e F 2 n X F 2 n ly 2 + xy = x 3 + ox 2 + p} u {o} a, p e F 2 n , p * 0 
and E[2 k ] is the set of points P of said elliptic curve such 
that P added 2 k times to itself gives the neutral element O, 
where k is an integer greater than or equal to 1, wherein a 
point P = (x,y) of said elliptic curve gives by said halving 

the point ~ P = (u G , A, G ) of said elliptic curve, 
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with A, 0 = u 0 + v 0 /u 0 , obtained by effecting the following 
operations : 

(a) seek a first value X Q such that X Q 2 + X Q = a + x; 

(b) calculate a second value u 0 2 such that : u Q 2 = x (X Q + 1) + 
Y; 

(c) if k has the value 1, check if the equation : X 2 + X =a 2 +u 0 2 
has solutions in F 2 n ; 

(d) if so, calculate said halving as follows : 

u 0 - V u o 2 / 



and 



P = (u 0 , X 0 ) ; 



(e) if not, add x to said second value u Q 2 and 1 to said first 



value A-o and calculate said halving as in step (d) ; 

(f) if k is greater than 1, perform the following iterative 
calculation : 

(i) seek a value A, ± , such that X ± 2 + - a + Ui_i; and 

(ii) then calculate the value u± 2 such that u± 2 = ui_i (X± + 
^i-i + Ui-i +1) by incrementing i from i = 1 until the value u 2 k -i 
is obtained; 

(g) check if the equation X 2 + X = a 2 + u\_i has solutions in 
F 2n; 

(h) if so, calculate said halving as follows: 

Uo = \I u q 2 t and 
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P = (u 0 , X 0 ) ; and 



(i) if not, add x to said second value u G 2 and 1 to said first 
value X 0 to calculate said halving as in step (h) . 

14. (New) A method according to claim 11, where F 2 n 
is a finite body of 2 n elements, E(F 2 n ) is the sub-group of an 
elliptic curve E defined by: 

E(F 2 n ) = { (x,y)e F 2 n X F 2 n ly 2 + xy = x 3 + ox 2 + P} u {o} a, p e F 2 n , p * 0 
and E[2 k ] is the set of points P of said elliptic curve such 
that P added 2 k times to itself gives" the neutral element O, 
where k is an integer greater than or equal to 1, wherein a 
point P = (x,y) of said elliptic curve represented by (x,X p ) 



with X p = x + y/x gives by said halving the point 



P = (Uo, 



v 0 ) of said elliptic curve obtained by effecting the following 
operations : 

(a) seek a first value X 0 such that X 0 2 + ^ 0 = ot + x; 

(b) calculate a second value u 0 2 such that u Q 2 = x (X Q + Xp + x 
+ i) ; 

(c) if k has the value 1, check if the equation: X 2 + X = a 2 
+ u 0 2 has solutions in F 2 n ; 

(d) if so, calculate said halving as follows: 
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2 

0 / 



v 0 = u 0 (u 0 + X Q ) , 



and 



P = (U 0 , V 0 ) ; 



(e) if not, add x to said second value u Q 2 and 1 to said first 
value X Q and calculate said halving as in step (d) ; 

(f) if k is greater than 1, perform the following iterative 
calculation : 



(i) seek a value X± such that X 2 + X± = a + ui-i; and 

(ii) then calculate the value u± 2 such that Ui 2 = Ui_i (X± + 
X-i-i + ui-i + 1) incrementing i from i = l until the value u 2 k _x is 
obtained; 

(g) check if the equation X 2 + X = a 2 + u 2 k _! has solutions in 
F 2 n ; 

(h) if so, calculate said halving as follows: 



u 0 = V u <> 2 / 



v 0 = u 0 (u 0 + X 0 ) , 



and 



P = (u 0/ v 0 ) ; and 



(i) if not, add x to said second value u 0 2 and 1 to said first 
value X 0 and calculate said halving as in step (h) . 
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15. (New) A method according to claim 11, where F 2 n is a 
finite body of 2 n elements, E(F 2 n ) is the sub-group of an 
elliptic curve E defined by: 

E(F 2 n ) = { (x,y)e F 2 n X F 2 n [y 2 + xy = x 3 + ax 2 + p} u {o} a, p e F 2 n , p * 0 
and E[2 k ] is the set of points P of said elliptic curve such 
that P added 2 k times to itself gives the neutral element O, 
where k is an integer greater than or equal to 1, wherein a 
point P = (x,y) of said elliptic curve represented by (x,A, p ) 



with X p = x + y/x gives by said halving the point 



P - (u 0 , 



v 0 ) of said elliptic curve represented by 

(u G/ X Q ) , with X 0 = u 0 + v 0 /u 0 obtained by effecting the 
following operations: 

(a) seek for a first value X Q such that X 0 2 + X Q = a + x; 

(b) calculate a second value u c 2 such that u Q 2 = x (A- G + + x 
+ i) ; 

(c) if k has the value 1, check if the equation X 2 + X = a 2 + 
u 0 2 has solutions in F 2 n ; 

(d) if so, calculate said halving as follows: 

u 0 = V u o 2 / 

and ^ P = (u 0 , Xq) ; 
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(e) if not, add x to said second value u D 2 and 1 to said first 
value X 0 and calculate said halving as in step (d) ; 

(f) if k is greater than 1, perform the following iterative 
calculation : 

(i) seek a value X i such that X ± 2 + A,i = a + Ui-i; and 

(ii) then calculate the value Uj. 2 such that u± 2 = ui_i (X± + 
^i-i + Ui_i + 1) incrementing i from i = l until the value u 2 k -i is 
obtained; 

(g) check if the equation X 2 + X = a 2 + u\_i has solutions in 



(i) if not, add x to said second value u G 2 and 1 to said first 
value A, 0 and calculate said halving as in step (h) . 



comprising constructing a common key from two secret keys 
respectively belonging to the aforementioned two entities and 
a public key consisting of the point P of odd order r of a 
chosen non-supersingular elliptic curve E. 



(h) if so, calculate said halving as follows: 




and 



- P = (u, 



X 0 ) ; and 



16. (New) A method according to claim 11, further 
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17. (New) A method according to claim 16, wherein a and b 
are the secret keys of first and second entities, 
respectively, and: ' 

(a) the first entity calculates the scalar 
multiplication [a] P and sends the result point to the second 
entity, 

(b) the second entity calculates the scalar 
multiplication [b] P and sends the result point to the first 
entity, 

(c) the two entities respectively calculate a common 
point (C) = (x,y) of said elliptic curve (E) by respectively 
effecting the scalar multiplications [a] ( [b] P) and [b] 

( [a] P) , both equal to [a.b]P, and 

(d) the two entities choose as their common key the 
coordinate (x) of said common point (C) obtained by said 
scalar multiplication [a.b]P, at least one of the preceding 
scalar multiplications, and preferably all of them, being 
effected by means of predefined halvings. 

18. (New) A method according to claim 11, further 
comprising calculating a signature between two entities based 
on a pair of permanent keys belonging to one of the entities, 
one secret (a) and the other public (Q) , by scalar 
multiplication of the secret key (a) by another public key 
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consisting of the point (P) of odd order r of a chosen non- 
supersingular elliptic curve (E) . 

19. (New) A method according to claim 18, further 
comprising the following operations: 

(a) the first entity (A) holding said pair of permanent 
keys constructs a single-use pair of keys, one key (g) being 
chosen arbitrarily and the other key [g] P resulting from 
scalar multiplication of said arbitrarily chosen key (g) by 
the public point P of said elliptic curve, the coordinates of 
the key ( [g] P) being denoted (x,y) with 2 < g < r-2, 

(b) the first entity (A) converts the polynomial x of 
said single-use key [g] P = (x,y) into an integer i whose 
binary value is represented by the sequence of binary 
coefficients of said polynomial x, 

(c) said first entity (A) calculates a signature (c,d) 
of the message (M) as follows: 

c = i modulo r 

d = g" 1 (M + ac) modulo r , 

(d) said first entity sends said message (M) and said 
signature (c, d) to said second entity; upon receiving it: 

(i) said second entity (B) checks if the elements 
of said signature (c,d) each belong to the range [1, r- 
1] , 
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(ii) if the check in step (i) is no, the second 
entity declares the signature invalid and stops; 

(iii) if the check in step (i) is yes, said second 
entity (B) calculates three parameters: 

h = d' 1 modulo r, 

hi = Mh modulo r, and 

h 2 = ch modulo r, 

(e) said second entity calculates a point T of said 
elliptic curve by summing the scalar multiplications of the 
points P and Q by the last two parameters cited: 

T - [hi] P + [h 2 ] Q, and 

(i) if the resultant point T is the neutral 
element, said second entity declares the signature 
invalid and stops; 

(ii) if the resultant point T is not the neutral 
element, considering the point T with coordinates x' and 
y' : T = (x> ,y' ) , 

(A) said second entity (B) converts the 
polynomial x' of that point into an integer i' whose 
binary value is represented by the sequence of 
binary coefficients or said polynomial x ! , 

(B) said second entity (B) calculates c' = i' 
modulo r and, 
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(C) said second entity (B) checks if c 1 = c, 
in which case said second entity (B) validates said 
signature, or if not, said second entity (B) 
invalidates said signature, at least one 
aforementioned scalar multiplication operation being 
effected by means of the predefined halvings. 

20. (New) A method according to claim 17, wherein scalar 
multiplication using halvings is obtained by the following 
operations : 

(e) if said scalar of the multiplication is denoted S, 
choose m+1 values So... Sm e {0/1} to define S as follows: 

s.£s,ri±iV. 

i = o V ^ ) 

r being the aforementioned odd order and m being the 
single integer between log 2 (r) - 1 and log 2 (r), 

(f) calculate the scalar multiplication [S] P of a point 
P of said elliptic curve by the scalar S by applying an 
algorithm consisting of determining the series of points (Q m+ i, 
Qm—/ Qi»./ Qo) of said elliptic curve E such that: 

Q m+1 = O (neutral element) , and 



Qi = [S ± ]P + 



Qi + i with o < i < m, and 



(g) calculate the last point Q Q of said series giving the 
result [S] P of said scalar multiplication. 
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21. (New) A method according to claim 11, wherein said 
integer is decomposed as a set of values using powers of half 
said order, and said addition and halving operations are 
implemented dependent on said set of values. 
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